Attribution is not recovery.
The FBI has attributed the theft of billions of dollars from Binance, described as the biggest cryptocurrency heist in history, to North Korean hackers. In a statement on Saturday, the bureau said this week's attack was tied to "malicious cyber activity" by an entity known as TraderTraitor, the same actors it links to a US$1.5 billion Bybit hack last year, according to the SCMP report.
The scale is striking. On Thursday, US$6.3 billion in bitcoin and other digital currency was taken from Binance, the world's largest crypto exchange, in what several cryptocurrency experts said bore the hallmarks of a North Korean operation. The FBI said its probe found TraderTraitor was converting the stolen assets primarily into ethereum, and it expects the group to try further conversions through DeFi and "instant swap services". The bureau has asked exchanges, blockchain analytics firms and others to block transactions linked to listed addresses so the money is not laundered to obscure its origins.
The mechanics of laundering such a sum are the next battleground. Ari Redbord, chief policy officer at the blockchain intelligence firm TRM Labs, said he expects the hackers to break the assets into pieces and push them through smaller exchanges to evade detection, a process that could unfold over months. "It's bank robbery, in this case, at the speed of the internet," he said, adding that the funds can nonetheless be tracked and traced in real time to build investigations, disrupt the movement and seize funds back. "It's just this cat and mouse game."
For customers, Binance said on Saturday that it had enough set aside in the same digital currency that was stolen to cover 90 per cent of the missing assets, and promised full reimbursement. That commitment is the most concrete reassurance in the reporting so far, though it leaves open how the remaining shortfall will be met and over what timetable.
The strategic significance lies in attribution and its limits. Naming TraderTraitor links this episode to a pattern Washington has already identified, and the public request for exchanges to freeze addresses turns a private forensic hunt into a collective enforcement exercise. But attribution is not recovery. The conversion into ethereum and the prospect of dispersal through smaller venues suggest the proceeds may be scattered faster than they can be frozen, and the burden falls on exchanges and analytics firms to act on the bureau's list.
Much remains unconfirmed. The reporting does not establish how the intrusion was carried out, whether any arrests or seizures have followed, or how much has already moved beyond reach. The FBI's statement, as relayed, does not detail the evidence behind the TraderTraitor attribution. What is clear is that the largest heist in the sector's history is now a test of whether public attribution and private compliance can together do what the thieves assume they cannot be stopped from doing.
